/****************************************************************************
 *
 * Copyright (C) 2003-2008 Los Alamos National Security, LLC
 *                         Packet Analytics Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License Version 2 as
 * published by the Free Software Foundation.  You may not use, modify or
 * distribute this program under any other version of the GNU General
 * Public License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 *
 ****************************************************************************/
package nfse.dataset.snort;

import nfse.NetFSE;
import nfse.NetFSERecord;

import java.sql.Timestamp;
import java.util.Calendar;
import java.util.Vector;
import java.util.GregorianCalendar;

public class SnortRecord extends NetFSERecord {

    public int sid = -1;

    public int cid = -1;

    public int sigClassID = -1;

    public int proto = -1;

    public String sigName = "";

    public int dstPort = -1;

    public int srcPort = -1;

    public long dstIP = -1;

    int priority = -1;

    String classification = "";

    String protoLine = "";

    String refLine = "";

    Vector<String> content = new Vector<String>();

    public SnortRecord() {

    }

    public void setDstIP(long dstIP) {
        this.dstIP = dstIP;
    }

    public int[] getIndexedFields() {
        int[] temp = { NetFSE.FIELD_START_TS, NetFSE.FIELD_DST_IP, NetFSE.FIELD_SRC_IP, NetFSE.FIELD_DST_PORT };
        return temp;
    }

    public SnortRecord(int sensor) {
        this.setSensorID(sensor);
    }
   
    public String toMultiLine() {
        StringBuilder temp = new StringBuilder("[**]");
        temp.append(" [" + this.sigClassID + ":" + cid + ":" + sid + "]");
        temp.append(" " + this.sigName + " [**]\n");
        if (classification.length() > 0 || priority != -1) {
            temp.append("[Classification: " + classification + "] [Priority: " + priority + "]\n");
        }
        temp.append(convertToSnortTS(getTimestamp()) + " " + this.getSrcAddr());
        if (srcPort != -1)
            temp.append(":" + srcPort);

        temp.append(" -> " + this.getDstAddr());
        if (dstPort != -1)
            temp.append(":" + dstPort);
        temp.append("\n");

        if (protoLine.length() > 0)
            temp.append(protoLine + "\n");

        if (refLine.length() > 0) {
            temp.append("Len: " + refLine.length() + "\n");
            temp.append(refLine + "\n");
        }

        for (int i = 0; i < content.size(); i++)
            temp.append((String) content.elementAt(i) + "\n");

        return temp.toString();
    }

    

    

    protected static Timestamp convertFromSnortTS(String snortTS) {
        // Example: 12/07/05-17:18:00.186017
        // System.out.println(snortTS);
        String[] values = snortTS.split("-");
        String[] dateValues = values[0].split("/");
        String[] timeValues = values[1].split(":");

        GregorianCalendar cal = (GregorianCalendar) Calendar.getInstance();
        cal.set(Calendar.MONTH, Integer.parseInt(dateValues[0]) - 1);
        cal.set(Calendar.DAY_OF_MONTH, Integer.parseInt(dateValues[1]));
        if (dateValues.length == 3 && dateValues[2].length() == 2)
            cal.set(Calendar.YEAR, 2000 + Integer.parseInt(dateValues[2]));
        else if (dateValues.length == 3)
            cal.set(Calendar.YEAR, Integer.parseInt(dateValues[2]));
        cal.set(Calendar.HOUR_OF_DAY, Integer.parseInt(timeValues[0]));
        cal.set(Calendar.MINUTE, Integer.parseInt(timeValues[1]));
        cal.set(Calendar.SECOND, (int) Float.parseFloat(timeValues[2]));
        return new Timestamp(cal.getTimeInMillis());
    }

    protected static String convertToSnortTS(Timestamp ts) {
        // Return Example: 12/07-17:18:00.186017

        GregorianCalendar cal = (GregorianCalendar) Calendar.getInstance();
        cal.setTimeInMillis(ts.getTime());

        int month = cal.get(Calendar.MONTH) + 1;
        int day = cal.get(Calendar.DAY_OF_MONTH);
        int year = cal.get(Calendar.YEAR);
        int hour = cal.get(Calendar.HOUR_OF_DAY);
        int minute = cal.get(Calendar.MINUTE);
        int second = cal.get(Calendar.SECOND);

        String temp = month + "/";
        if (day < 10)
            temp += "0";
        temp += day + "/";
        temp += year + "-";
        if (hour < 10)
            temp += "0";
        temp += hour + ":";
        if (minute < 10)
            temp += "0";
        temp += minute + ":";
        if (second < 10)
            temp += "0";
        temp += second + ".0";

        return temp;

    }

    protected static int convertFromSnortProtocol(String protocol) {
        protocol = protocol.toUpperCase().trim();
        int proto = -1;
        if (protocol.equals("UDP")) {
            proto = 17;
        } else if (protocol.equals("TCP")) {
            proto = 6;
        } else if (protocol.equals("ICMP")) {
            proto = 1;
        } else {
            int idx = protocol.indexOf("PROTO");
            if (idx == 0) {
                proto = Integer.parseInt(protocol.substring(5));
            }
        }
        return proto;
    }

 
    @Override
    public long getDstIP() {
        return dstIP;
    }

    @Override
    public int getDstPort() {
        return dstPort;
    }

    public int getSrcPort() {
        return srcPort;
    }
    
    public int getProtocol() {
        return proto;
    }
    
    public boolean isAlert() {
        return true;
    }
    
    public String getAlertMessage() {
        return this.sigName;
    }

    @Override
    public boolean hasBinary() {
        return true;
    }
}